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REMARKS 

Reconsideration of this application is respectfully requested in view of the foregoing 
amendment and the following remarks. 

Claims 1-7, 9-11, 13, 14, 16-19, 21-34, 36-38, and 40-54 remain pending in this 
application. Independent claims 1 and 28 have been amended to further clarify a recursion 
feature of the present invention. No new matter has been entered. Support for the amendment 
can be found, for example, in the paragraph beginning at page 12, line 33. 

For the reasons stated below, Applicants respectfully submit that all claims pending in 
this application are in condition for allowance. 

Applicants' representative thanks Examiner El Chanti for the courtesies extended during 
the telephone call of August 17, 2005. The substance of the call is incorporated into the 
following remarks. 

The claims of the present application stand rejected under 35 U.S.C. § 102(e) as allegedly 
being anticipated by U.S. Patent 5,796,942 to Esbensen. To the extent this rejection might still 
be applied to the claims presently pending in this application, it is respectfully traversed. 

The present invention is directed to a system and method for analyzing data traveling 
through a network. In accordance with the present invention, a data stream is collected and 
resolved into logical groupings, typically made up of a plurality of packets. These packets are 
then assembled into respective sessions to recreate, where possible, a complete session between 
two end points, i.e., two computers. It is upon these assembled sessions or "session objects" that 
a lexical engine operates to identify one or more network events. Significantly, and as noted 
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during the telephone call of August 17, 2005, the present invention provides that the lexical 
engine is operated "recursively." As explained in the paragraph beginning at page 12, line 33 of 
the present application 



Because network protocols may be nested, for example, a POP-3 
session may contain one or more instances of RFC822 email 
sessions, application sensor 126 may be applied recursively to 
identify protocols within other protocols to extract nested or 
underlying objects encapsulated in one or more different protocols. 



Recursion has a well-understood meaning in the computer programming art. Recursion 
is u the ability of a subroutine or program module to call itself. It is helpful for writing routines 
that solve problems by repeatedly processing the output of the same process." The Computer 
Glossary, the Complete Illustrated Dictionary, Eighth Edition, Freedman, A., Ed., AMACOM 
(1998). This is precisely the type of recursion that is contemplated by the present invention in 
order to "extract nested or underlying protocols." 

As tentatively agreed by Examiner El Chanti, this recursion feature, now even more 
expressly recited in the independent claims 1 and 28, is neither disclosed nor suggested by 
Esbensen. Specifically, the final Office Action of April 1 8 relies heavily on col. 5, lines 15-55 of 
Esbensen as allegedly disclosing multiple features of the claimed invention, including the 
"recursive" features originally recited in dependent claims 20 and 47. This passage of Esbensen, 
however, in fact discloses nothing regarding a recursive application of a lexical engine by an 
event sensor, let alone one that is operable to extract nested or underlying objects encapsulated in 
one or more different protocols, as is now recited in the independent claims. 
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For at least these reasons, Applicants respectfully submit that the independent claims, as 
amended, along with the remaining dependent claims, are patentable over Esbensen. 
Reconsideration and withdrawal of the §102 rejection is accordingly urged. 

Two other issues remain regarding this case: (1) the correspondence address for this 
application and (2) the Petition to change the order of inventors filed April 27, 2004. 

As to (1), Applicants' representative urges the Patent Office to correct its records to 
reflect the correspondence address as requested in the Change of Attorney Address filed June 21, 
2005. The failure of the Patent Office to make this change has delayed the prosecution of this 
application. 

As to (2), Applicants respectfully request a notification that the Petition is granted or an 
opportunity to resubmit the Petition in the event it is denied. 
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In view of the foregoing all of the claims in this case are believed to be in condition for 
allowance. Should the Examiner have any questions or determine that any further action is 
desirable to place this application in even better condition for issue, the Examiner is encouraged 
to telephone applicants' undersigned representative at the number listed below. 

SHAW PITTMAN LLP 
1 650 Tysons Boulevard 
McLean, VA 22102 
Tel: 703/770-7900 

Date: August 1 8, 2005 

Attachments: None 
LDE/dkp 

Customer No. 28970 
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